EUVD-2026-68520
GHSA-4j65-5xpm-5rmq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H required for database or admin access; AV:N since application is web-accessible; only low confidentiality impact as passwords are exposed only to already-privileged parties.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive information. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
AnalysisAI
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires high-privilege access to the Student Management System application or direct read access to the underlying database - consistent with the CVSS 4.0 PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.0 reflects the limited real-world risk accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a discrete version number has been identified at the time of analysis, as this product follows a rolling release model. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Student Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands vi
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via t
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today